Full SSL/TLS encryption mode - Only Allow Client with Certificate for subdomain

Website, Application, Performance Security
1

What is the name of the domain?

duchesne.ca

What is the issue you’re encountering

None, general question before implementing and changing our NS

What is the current SSL/TLS setting?

Full (strict)

What are the steps to reproduce the issue?

We need to be able to access one of our subdomain only if the client has the certificate.
If I understand correctly, it seems to be possible if we put Encryption mode at “Full” for this hostname only, but we want to be sure that will work and is the proper way of doing it before changing our NS to cloudflare. The rest of the domain would be set at Full (strict).

Another option seems to be to use Client Certificates, but we have the Pro plan only and we would like to keep our own. By the documentation we would need the Enterprise plan to do this.

How should we proceed?

Thanks in advance!

2

Full only means that Cloudflare does not verify the certificate on your server, and is thus insecure. It has nothing to do with access control.

Does that mean you are already using client certificates? Or do you mean you want to keep using your own server certificate?

3

We are not using Client Certificates with Cloudflare, but we already have some installed on our users devices to access our server. If possible we would want to keep using our own server certificate, yes.

4

I don’t fully understand what you’re trying to do. You can disable Cloudflare for a specific subdomain if that is what you want.

5

I believe what you are looking for is mTLS which is covered here.

6

We want cloudflare to only allow trafic to a hostname if the clients have our certificate.
We might just disable it like you said in the end if we can’t go with enterprise for the custom certificate.

7

Yes I read about it, but the issue is that we need enterprise to bring our own CA Certificate.

Would it be possible to create a cloudflare client certificate only for our subdomain and then deploy it?
If we can, we might move on from our own certificate and go with the mTLS.

8

You can set up mTLS on any (sub)domain you want. The client cert is generated for host names associated with it AFAIK

9

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.